ce7cb702218693d08ea6d83464d2457c9250027c

services/short/k8s/tunnel/admission.yaml

@@ -0,0 +1,49 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata: {name: short-election}
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+      - apiGroups: [""]
+        apiVersions: [v1]
+        operations: [UPDATE]
+        resources: [pods]
+  matchConditions:
+    - name: tunnel-account
+      expression: request.userInfo.username == 'system:serviceaccount:short:tunnel'
+  variables:
+    - name: labels
+      expression: "has(object.metadata.labels) ? object.metadata.labels : {}"
+    - name: oldLabels
+      expression: "has(oldObject.metadata.labels) ? oldObject.metadata.labels : {}"
+  validations:
+    - expression: >-
+        oldObject.metadata.namespace == 'short' &&
+        oldObject.spec.serviceAccountName == 'tunnel' &&
+        'app.kubernetes.io/name' in variables.oldLabels &&
+        variables.oldLabels['app.kubernetes.io/name'] == 'tunnel'
+      message: The tunnel may only update tunnel pods.
+    - expression: object.spec == oldObject.spec
+      message: The tunnel may not change pod specifications.
+    - expression: >-
+        variables.labels.all(k, k == 'role' ||
+          (k in variables.oldLabels && variables.labels[k] == variables.oldLabels[k])) &&
+        variables.oldLabels.all(k, k == 'role' || k in variables.labels) &&
+        (!('role' in variables.labels) || variables.labels['role'] == 'active')
+      message: The tunnel may only set or remove the active role label.
+    - expression: >-
+        (has(object.metadata.annotations) ? object.metadata.annotations : {}) ==
+        (has(oldObject.metadata.annotations) ? oldObject.metadata.annotations : {}) &&
+        (has(object.metadata.ownerReferences) ? object.metadata.ownerReferences : []) ==
+        (has(oldObject.metadata.ownerReferences) ? oldObject.metadata.ownerReferences : []) &&
+        (has(object.metadata.finalizers) ? object.metadata.finalizers : []) ==
+        (has(oldObject.metadata.finalizers) ? oldObject.metadata.finalizers : [])
+      message: The tunnel may not change annotations, owners, or finalizers.
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata: {name: short-election}
+spec:
+  policyName: short-election
+  validationActions: [Deny]